Description
The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.
Remediation
References
Related Vulnerabilities
WordPress Plugin Fluid Responsive Slideshow Multiple Vulnerabilities (2.2.6)
Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-3370)
WordPress Plugin Spiffy Calendar Cross-Site Scripting (3.2.0)
WordPress Plugin FV Flowplayer Video Player URL Cross-Site Scripting (1.2.11)